Totalprocessing Nomupay Payment Processing Gateway Path Traversal Vulnerability Allowing Arbitrary File Download

A path traversal vulnerability has been identified in the Totalprocessing Nomupay Payment Processing Gateway plugin for WordPress, affecting versions through 7.1.7. This vulnerability allows arbitrary file download by improperly restricting file paths, potentially enabling the download of sensitive files such as those containing login credentials or backup data.

Impact

Exploitation of this vulnerability could lead to unauthorized downloading of files from the affected website, including sensitive information like login credentials or backup files.

Remediation

Users of the Totalprocessing Nomupay Payment Processing Gateway plugin should update to version 7.1.8 or later. Patchstack users can enable auto-updates for vulnerable plugins.